User Profile Service & ADFS in Multi-Tenant

For the past several weeks, I have been working in getting ADFS work in dedicated environment. The process is fairly simple once you have a server with ADFS running.
Here is a list of things you need in SP:

1. Token Signing Certificate of ADFS Server.
2. IIS Web Server Certificate of the server hosting ADFS.
3. Atleast Self Signed SSL Cert of the IIS Server that is hosting SP.
4. You need to define your claims in ADFS and then map them as well.
5. Finally, you have to write a power shell script something like this in order to set up the new token identifier.

write-host "Adding ADSF Cert"
$cert = New-Object System.Security.Cryptography.X509Certificates.X509Certificate2("C:\ADFS\adfs.cer ")
New-SPTrustedRootAuthority -Name "Token Signing Cert" -Certificate $cert

$map = New-SPClaimTypeMapping -IncomingClaimType "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress" -IncomingClaimTypeDisplayName "EmailAddress" -SameAsIncoming
$map2 = New-SPClaimTypeMapping -IncomingClaimType "http://schemas.microsoft.com/ws/2008/06/identity/claims/role" -IncomingClaimTypeDisplayName "Role" -SameAsIncoming
$map3 = New-SPClaimTypeMapping -IncomingClaimType "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname" -IncomingClaimTypeDisplayName "GivenName" -SameAsIncoming
$map4 = New-SPClaimTypeMapping -IncomingClaimType "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname" -IncomingClaimTypeDisplayName "SurName" -SameAsIncoming
$map5 = New-SPClaimTypeMapping -IncomingClaimType "http://schemas.microsoft.com/ws/2008/06/identity/claims/windowsaccountname" -IncomingClaimTypeDisplayName "windowsaccountname" -SameAsIncoming
$map6 = New-SPClaimTypeMapping -IncomingClaimType "http://schemas.microsoft.com/ws/2008/06/identity/claims/groupsid" -IncomingClaimTypeDisplayName "GroupsId" -SameAsIncoming

$realm = "urn:seo:sharepointMT"

write-host "Setting up STS in SharePoint"
$ap = New-SPTrustedIdentityTokenIssuer -Name "ADFS Provider" -Description "SharePoint secured by SAML" -realm $realm -ImportTrustCertificate $cert -ClaimsMappings $map,$map2,$map3,$map4,$map5,$map6 -SignInUrl "https://ADFSServer/adfs/ls" -IdentifierClaim "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress"

#This is ADFS Web Serv cert
$certPath = "C:\ADFS\MachineCert.cer"
$cert = New-Object System.Security.Cryptography.X509Certificates.X509Certificate2(“$certPath”)
New-SPTrustedRootAuthority “ADFS web server” -Certificate $cert

#This is the cert associated with the server running IIS/SP
$mycert = New-Object System.Security.Cryptography.x509Certificates.x509Certificate2("C:\ADFS\VM55.cer");
New-SPTrustedRootAuthority –Name "IISSSL" –Certificate $mycert;


User Profile Service using ADFS



In order to get this to work, there are a few things that have to be done before synchronizing users.

Here is a list:

• Port 389 has to be opened on network that has ADFS Server running.
• An AD User who has delegate permission/replicate should be created and provided to SP
• Then, you can  go to User Profile Service and add new connection and choose ADFS as login method. When you choose ADFS, your STS provider will be listed in a drop down. Choose that. Then, put the user and password of the AD User that was created above to save.
• Finally, start incremental/full import.

 ADFS & Multi-Tenancy

I did not find a lot of information on this where ADFS will work in multi-tenancy. In Office 365, it works, but that is on cloud. I started on this after finishing the above 2 big technical blocks. I was able to SUCCESFULLY set up ADFS in a multi-tenant environment.

You may have a scenario where there are 2 Tenants that are connected to different ADFS servers and you only want to display the STS they are mapped to. This can be accomplished by creating a custom login page which has a drop down with the name of STS provider that tenant is mapped. This drop down can be populated in multiple ways.

UPS using ADFS in multi-Tenant

This was the grand daddy of all the above or in other words the cherry on top of this massive technical sundae. I got this to work as well. This was not bad, but the only catch here is that you have to set OU when provisioning tenants. There is a document on Harbar.net that provides details on how you set up OU, but other than that it is fairly similar to dedicated environment. The other noted difference is that you use the UPS of CA, to set up connection and so forth. However, you need to goto Tenant's CA, to see all the users.

If you are having difficulties in getting this to work, here is a list of things that you may want to check:

• You should be able successfully login via ADFS.
• Port 389 is open
• User with appropriate permission has been used. (Note: A Farm Admin or System admin will not help)
• Check Fore Front Identity Management for the successes and failures.

If the above still does not help, it is time to open SQL Server that is associated with SP. This not the thing you should be touching, but if above things are all correct, you would have to open the Profile database. In that database, look at Tenant table and look at SynchronizationOU column. This column should have the appropriate OU, you have defined for the Tenant. Then, finally look at the UserProfile_Full and ensure that the users exists and if they do, check the partition id so to ensure they are mapped to the right tenant.

Supercharged Content Query WebPart

For the last 2 weeks, I have been working on a very challenging assignment that another senior SharePoint architect stated that cannot be done. Here is a scenario; we want to dynamically pull the data from a list based upon a hierarchy structure that is tied to the user who has logged in to the system. The most obvious choice would be to use Content Query Web Part. The challenge here is that we are limited by 3 filters and what if we want to bring the data from Parent and its 8 children. This is not possible unless we start writing massive CAML.

Here is the solution I implemented for solving this problem. You create a webpart that inherits directly from CQWP and then in that class you can set your filters depending upon your requirements. Remember we cannot have more than 3 filters with CQWP even when we overwrite via VS. The key part of the solution is to map our hierarchy structure with a Term Store. The reason why this is a very cool idea is because in SP 2010 term store are 100% integrated with CQWP. When you define a column in the list of type managed metadata then you can use that as one of the filters in CQWP. When you use this column in CQWP, it gives you an option to include children as this is now supported in SP2010.

The other key aspect of this solution was to via code to set the filter based on the term that is associated with the current user. In the initialize of the inherited subclass, we will add code something like this, which will dynamically set the filter every time the webpart is executed.

this.FilterField1 = “Taxonomy Field Name”;

this.FilterOperator1 = ContentByQueryWebPart.FilterFieldQueryOperator.ContainsAny;

this.Filter1ChainingOperator = ContentByQueryWebPart.FilterChainingOperator.Or;

this.FilterType1 = "TaxonomyFieldTypeMulti";

this.FilterIncludeChildren1 = ShouldHaveDescedant();

this.FilterValue1 = ResolveFilterValue();

I don't want to get into the details about the power of CQWP on its own, but now when we combine CQWP with taxonomy we are going to produce a supercharged version of CQWP.

How to marry AD Claims User and Forms Based Users?

    I have been working at a client that uses FB authentication model to authenticate all users and to create new users. This works great as everything is with the SQL Server and you could associate users to different locations/departments, which are defined in SQL Server.

    However, there are scenarios where internal users need to log to SP site and they don’t necessarily have to use their FB authentication. There are other scenarios where the user may not exist in FB system, but in order to use the system they have to be created/registered in FB system. It would be really cool, if we could have the system in such a way that when an AD user logs to the SP Site, the system looks if the user exists in the FB database, if not, then checks a flag to see if I can auto add this new user all at once.

    How do you do such a thing where you can auto add an AD user with their groups as they are mapped to different locations the user exists and their other data(Title/Phone…etc)? This involves a couple of different components within SP/.NET world. First, you would need to examine the claims the user is bringing when coming via AD world. This is the most important step in the process as if you cannot find the UPN, then everything will break. You would need to have the email address of the AD user also to examine if the system already has a user in the database. We have an assumption that FB/AD user have the same email address as technically they are 2 different users, but we trying to impersonate AD user with FB user. The next thing you would need is to use the identity framework to examine what are the groups users belongs to so that you can map them to locations/departments in the system. Finally, you would need to active User Profile Service in order to extract other pieces of information like Title, Phone number etc. Once you have collected all this data, you can easily go ahead and create the FB user with this information.

    Thereafter, every time an AD user logs into the system, we query the db to find associated FB user and then make every single call as if the FB user is making. This is in brief how you would marry AD with FB 

Upgrading WebParts as Part of Feature Upgrade

Have you ever had an opportunity where you need to add web parts using SP upgrade? Alternatively, you have successfully upgraded, but web parts don't show up in the Web Gallery? This happens as the code gets deployed and you can refer to webpart via code, however it will not show up in the gallery.
When you upgrade a feature, SP simply ignores all the ElementManifests it finds in the Feature.XML file. The other thing you have to realize is that by default provisioning only occurs during feature activation and not during the upgrade. How do you ensure that during the feature upgrade a webpart is successfully provisioned and gets displayed in the WebPart Gallery? Here are the steps you have to follow using the easier declarative method:
Assumptions:
Name of Feature : MyFeature
Web Part Provisioned : MobilePasswordReset
Step 1: In your solution, open MyFeature.Template.XML file, this is the file that will have the name of the feature followed by template.XML.
Step 2: This is how your file will look for most of the cases unless there is some upgrade statements.

Step 3: Need to make a few changes to the above file:
-Add Id of Feature.
-Add Scope
-Upgrade Actions->ApplyElementManifest->ElementManifest

This is how your XML should look as per the image.

Now, when you run the upgrade power shell, the web part will be provisioned. What will happen is that SP will look in this location and it the web part gallery. The other thing to note is that anything you write in customupgradeaction will not help, unless you write code in that event to add webpart to gallery.

How to make a .NET Developer become a good SharePoint Developer?

This morning, in the shower I started thinking how do you transform a .NET Developer into a good SharePoint Developer. I guess a part of the reason why I started thinking in those terms is because I successfully conducted a SharePoint 2010 Developer training at a client recently.
The training was great if you have SharePoint background. If you are a .NET developer the training will provide you lot of information about SharePoint not necessarily enough for you to start developing professional grade applications in SharePoint. I started thinking as to what all is required for a .NET developer to start developing in SharePoint. If you look in the market, there are at least 4 different SharePoint training tracks available (Developer, Power User, Admin, and Branding). Organizations across the globe are spending money to train their employees in one or more SharePoint trainings in order to transform them as .NET developers to SharePoint developers. At the same time, the companies are savvy and they don’t want to spend more money than it is required. There is a lot of pressure on both sides as the expectations are that after the .NET developer goes through some training they are ready for doing SharePoint development. This may be true in an ideal condition, but we are not living in an ideal world so this expectation has to be discounted. In my opinion, you need a mix of 4 training tracks in order to make a good SharePoint developer.

I came from .NET background and I have successfully transformed into the SharePoint World. I have been doing SP for a while now and specifically SharePoint 2010 for over a year now where I have done everything from capacity planning, architecture, development, administration, and training.
There is a thin line between what bare minimum you need to know is and what is too much in SharePoint. In this document, I am going to define at a high level what all you need to know in order to become a decent and then in future a good SharePoint developer. This will be a combination of Administration, Development, and Power User training.
This training is like how you would do a project using one of the agile methodologies. This learning program is continuous and iterative in nature where you build upon what you learnt in Part 1 all the way up to Part 5. I have added part 6 only for very advanced learning.
Part 1:
• First of all developers, need to understand the big picture as to what are main components of SharePoint. It would be useful, if they went through an exercise of installing SP on their box.
• Assuming you have SP available, .NET developers need to understand the relationship or core concepts between WebApplication/Site Collection/Site. This is similar to class having different scopes.
• The developers also need to understand at a high level what is Central Administration and what you can do with it.
• The developers need to create their 1st Web Application, Site Collection and Site. In addition, look at the file server as to what happens when a WebApplication is created. This is similar to what you do when you create a ASP.NET web. Explore the IIS Server to see the files that are added when you create a new web application.
• The developers need to understand that SP is nothing but a massive ASP.NET application and some of the principles they have learnt over the years as part of ASP.NET development can easily be reapplied in SP. Some of the concepts are caching, web configuration, session, query string parameters, relationship with IIS, HttpHandlers and HttpModules, postback events and so on.
Part 2:
• Assuming SP Site is available, the developers need to explore a site via browser and see what all components are available. You have to explain to developers and let them play with the different components of the Site.
• You should explore at creating different types of sites using the templates available, lists, content types, and columns and so on.
• Teach the developer to be aware of factors that help in deciding how many site collection you need for your given environment/solution. A good overview of what is within a site collection will be helpful.
• Next on the list is to expose the developer to SharePoint Designer. Let the developers try things in SP Designer and then view them in browser. I would also suggest that you spend some time with them in explaining what are bad things can (not) be done with SP Designer and how you can control it. This could be a good time to explain to them different security groups available (Farm Admin/Site Collection…)
• Once a developer has been familiarized with SharePoint Designer and accessing the site via browser and Central Admin, it may be a good idea to expose him to Power Shell. This should be a brief introduction to PowerShell as this is something that developers don’t necessary have to do as part of their daily job.
• Now expose the developer to the capabilities of InfoPath form. Give them an overview of what InfoPath forms can do and not do and where it is useful to use them as compare to not using them.
• This may be a good time for you to explain the developers about Site and Site Collection Features.
Part 3:
Assumption: At this point of time, the developer should have knowledge of the Site, Site Collection and Web, Central Administration, SP Designer, and Power Shell.
• Educate the .NET developer with what is in the SP Object model especially from Site Collection and below.
• Educate the developer on creating a basic Web Part and how it is deployed in the local environment. At this point it would be useful if you can explain the developer the differences between Farm Solution/Sandbox Solution and Visual Web Part and WebPart. During this process, explore the Visual Studio project and show the developer as to what is a Feature/Package.
• You could extend what was covered in the previous point to give them a better understanding of Feature and different scopes. This could take some time for the developer to understand, but this is critical.
• You should know expose the developer to 14 Hive in relationship to what was deployed above and some other things about 14Hive.
• Teach the developer to access a list programmatically and to do all the CRUD operations (LINQ/CAML) as well as events that are available.
• Teach the developer to create workflows in SP using a combination of SP Designer/VS and browser. You could give developer information about 3rd party products like K2 and Nintex that they can explore or read white papers in their spare time. During this step, you can tell the developers about Content Types as they would have picked some concepts in earlier part, but it may be useful.
• Teach the developer about the master page and application page as to how similar they are to ASP.NET master pages. The same theory holds true for page layouts/CSS etc. It may be useful to educate the developer on delegate controls as that is quite handy. You should also spend some time in explaining between different kind of pages that are available within SP and when is a particular page used.
• This is the natural extension of the last point where educate the developers on concepts like Ghosting/UnGhosting and Customization of Page.
• Teach the developers about Site provisioning, events associated with them and site templates.
• Teach the developer about BCS. BCS is further divided among the types of solutions where it no code or with code. No code is further divided among doing pure OOTB or some customization. The amount of time you want to spend on this topic would be directly proportional where you want to place this developer after they have completed the training.
Part 4:
At this point of time, your developer should be able to create basic Web parts that can access data from the Lists and then deploy it to their local environments comfortably. In this section of training, you have to just help the developer know about basic Software development process involved with SP. The .NET developer already knows how to do these things in non SP world, but they would not have an idea as to how to do things in SP.
• Teach them about checking in and checking out code from repository.
• Teach them about building packages and then deploying it via PowerShell.
• Teach them about what constitutes code as compare to content.
• Provide them with an overview of how SP development is done with teams and how the code is promoted all the way to Production.
• Teach them how to create their local environments.
• Teach developers about value of error handling that needs to be built in their code and some of the other developer items such as developer dashboard/ULS logging. This may be a good time to show them how you can control what events get logged in to SP via Central Administration.
• It may be useful to at least show the developer about SP jobs and you can create your own jobs.
Part 5:
At this point of time, your developer should be able to comfortably create a professional solution and then pass the package to administrator to be deployed in the next environment. Some of the other concepts that you can cover depending upon factors like time etc.
• MetaData and Taxonomy
• Web Analytics
• Content Organizer, Document Sets
• Client Object Model
• REST API
• Search – This is a very large topic, but you can give an overview of what is available within SP. Show the developer as to what can easily be accomplished without writing code. If required, you can also give overview of the object model that is associated with the Search for doing custom development.
• Excel/Access/Visio Service – Similar to search you can give an overview or if required go into the object model if there is any custom coding is required.
• Records Management.

Part 6: [Advanced]
• Security Model of assigning permissions via code.
• Claims Based Authentication
• Ribbon Customization
• Writing your own Custom Service.

As you see from the above program, the list of things that you need to teach in order to transform a .NET developer into a SP developer. If you have any questions or would like some more information please reach out to me via my LinkedIn account link.

SharePoint Search using Scope

In SP, you can easily slice and dice your content to search a specific document library or list. Last week, I posted an article that can be used when you want to search a given list on specific columns that are not exposed directly by METADATA.

In my experience, the below article would cover several business needs. These needs are specific to the clients I have worked with on Search. One of the needs is that we have so much of simillar data that when we search we get too much of results and not directly from the library that we are interested to get the data from. The other need is I need to get a list of all documents that have been modified/created/ by a user/date in this document library. You could have used a view here, but then that is specific and the user has to be educated. This cannot be dynamic.

Today, I am going to be documenting an Out of the BOX Scope feature that can be used perform a search specific to library/List/Sub Site. A user with site collection admin perms, can go to Site Settings->Search Scopes and then add a new Scope. Once you add a new item, then you can define the rules that are specific to the new Scope. After this, you have a choice of displaying this new Scope element in search box next on the top of the page and in the Basic Search Center's Advanced Search Page.

Assuming you have managed to get the above steps completed. Now, you need to go back to Central Admin- Services on Server-> Search-> Search and do a full crawl to have the new scope reflected in the Search Center. Once this has been completed, go back to Basic Search Center's Advanced Search Center page and you will be able use the new scope.
The same scope can also be developed using Visual Studio. This may be necessary when you have to repeat a process in multiple environments. In addition, some organizations don’t allow any direct updates so in that case you would need to write this scope via Feature and deploy it in your appropriate environment.
Next topic: Best Bets!

SharePoint Search on a Specific Document Library/List

How can you use OOTB search to perform search on a single specific list? When you perform a search, it will search those areas depending upon your content source, which is never specific to a single library containing documents. How can you perform a search where it only pulls the data from this given document library? You could use a common document property and then map it to perform your search. However, this is not a very consistent approach as some users may forget to do so. Therefore, it is better to use a column to create this feature. An alternative approach is to simply use scopes!

The key concept here is a metadata property that needs to be used. In this document, I will very briefly walk you through the process and show you how this can be extended to N number of document libraries. The same process can easily be applied to a list.

1: Create a document library for some finance group that you want to have a specific search upon. If that library exists, create a new column and call it MySearchColumn with a default value (Finance) and make sure the column is marked as not required field. Better, create a site column and then use it in this list. I will come back to why I suggested a site column.

2. Next, Go to the advanced setting of the Library and click on Manage content types. Once you do that, you will see the option to hidden the MySearchColumn from the form. This is a neat trick to hide the extra irrelevant column from the user and still maintain consistency. You could have let this column be there and the user could have asked you several questions. You could have educated the user on why you have this column in its place. You could have also written an event handler to ensure the value is consistent.
3. Now try adding a new document to the library and the MySearchColumn is not displayed on EditForm.aspx. Note, it will be visible from the “All Documents” view, but you can change this once you have completed the task.
4. Go to Central Administration -> Search Service Application->Search Administration and do a crawl. The reason you have to do this is so that the newly added column will be displayed in the MetaDataProperty.
5. Now create a new Meta Data Property by giving it a name “MyMetaDataProperty” that is mapped to ows_MySearchColumn. You should see this ows_MySearchColumn when you go to AddMapping. If you don’t see the column then there is a problem with your crawler or field name.
6. Next create a “Basic Search Template” that will be used to perform the search. When this is created a basic search page gets displayed. Click on the “Advanced Search”. On this page, edit the “advanced search webpart” to include this new property that you have created in Search Administration. When you click edit webpart, it displays you properties of the web part you can change. Click on properties section to open the box and then copy the XML into an XML editor where you need to add simillar following lines


Then, you need also include in the results section


7. Once this is completed, you should see 1 more managed property. Now, start a full crawl from
“Search Admin” and not an incremental crawl as the data from the new property will not show up.

8. Go to Advance search and choose the new property from the drop down below and choose equals “Finance” and perform you search. You should see results coming from that 1 single document library.

9. Similarly, if you have more document libraries you can reuse the same site column, but with a different value. The advantage of this approach is that you don’t have to set another meta data property and just put different value and you can now search exclusively in a different document library.